nanoid Infinite Loop via Negative Size in non-secure module
Priority LOW 36CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 26 fixed, 17 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Partial nanoid (nanoid_project): 5.1.16, 3.3.16nanoid (npm): 3.3.16, 5.1.16Red Hat: 28 advisoriesRed Hat: 26 fixed, 17 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nanoid_project | nanoid | 4.0.0 to before 5.1.16; before 3.3.16 | 5.1.16, 3.3.16 | Patch available | CNA |
| — | nanoid (npm) | before 3.3.16 | 3.3.16 | Patch available | GHSA-28wg-ghj8-5hjv |
| — | nanoid (npm) | 4.0.0 to before 5.1.16 | 5.1.16 | Patch available | GHSA-28wg-ghj8-5hjv |
- nanoid Vendornanoid_project Affected 4.0.0 to before 5.1.16; before 3.3.16 Fixed in 5.1.16, 3.3.16 Patch available CNA
- nanoid (npm) Vendor— Affected before 3.3.16 Fixed in 3.3.16 Patch available GHSA-28wg-ghj8-5hjv
- nanoid (npm) Vendor— Affected 4.0.0 to before 5.1.16 Fixed in 5.1.16 Patch available GHSA-28wg-ghj8-5hjv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:* | before 3.3.16; 4.0.0 to before 5.1.16 | Vulnerable | nanoid_project |
- cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:* Versions before 3.3.16; 4.0.0 to before 5.1.16 Vulnerable ·nanoid_project
Remediation
- Fix · CNA nanoid (nanoid_project) Fixed in 5.1.16, 3.3.16
- Fix · GHSA-28wg-ghj8-5hjv nanoid (npm) Fixed in 3.3.16 Advisory →
- Fix · GHSA-28wg-ghj8-5hjv nanoid (npm) Fixed in 5.1.16 Advisory →
Red Hat 28 advisories
- RHSA-2026:92650 Released 2026-10-29 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:83598 Released 2026-10-15 · Red Hat rating ImportantRHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Show 25 more Red Hat advisories
- RHSA-2026:81110 Released 2026-10-12 · Red Hat rating ImportantRed Hat Quay 3.18.1
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
- RHSA-2026:79088 Released 2026-10-08 · Red Hat rating CriticalRed Hat Developer Hub 1.10.5 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:74511 Released 2026-10-01 · Red Hat rating ImportantRed Hat Quay 3.17.5
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:71113 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse-0.6.0-1.el10ap, python3-sqlparse-0.6.0-1.el10ap, receptor-1.6.8-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.17-1.el9ap, automation-controller-cli-4.7.17-1.el9ap, automation-controller-server-4.7.17-1.el9ap +7
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:69255 Released 2026-09-21 · Red Hat rating ImportantRed Hat Quay 3.16.6
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:69248 Released 2026-09-21 · Red Hat rating ImportantRed Hat Developer Hub 1.9.9 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:66523 Released 2026-09-10 · Red Hat rating ImportantRed Hat Quay 3.12.22
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:66084 Released 2026-09-09 · Red Hat rating ImportantRed Hat Quay 3.10.26
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:65514 Released 2026-09-08 · Red Hat rating ImportantRed Hat Quay 3.9.26
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:65155 Released 2026-09-08 · Red Hat rating ImportantAnsible plug-ins for Red Hat Developer Hub Product Release Update
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:65118 Released 2026-09-08 · Red Hat rating ImportantAnsible plug-ins for Red Hat Developer Hub Product Release Update
- Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
- RHSA-2026:63307 Released 2026-09-03 · Red Hat rating ImportantRed Hat Quay 3.15.8
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:61783 Released 2026-08-31 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:60390 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
- RHSA-2026:60388 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
- RHSA-2026:60387 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
- RHSA-2026:60386 Released 2026-08-26 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
- RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.17.2 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
- RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.9.7 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
- RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.10 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
- RHSA-2026:59030 Released 2026-08-24 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images grafana13.2-13.2.0-0.1.1.hum1@aarch64, grafana13.2-13.2.0-0.1.1.hum1@src, grafana13.2-13.2.0-0.1.1.hum1@x86_64
- RHSA-2026:48320 Released 2026-07-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images jaeger-2.20.0-0.7.hum1@aarch64, jaeger-2.20.0-0.7.hum1@src, jaeger-2.20.0-0.7.hum1@x86_64
- RHSA-2026:48241 Released 2026-07-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.1-0.3.hum1@aarch64, grafana13.1-13.1.1-0.3.hum1@src, grafana13.1-13.1.1-0.3.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 | Fixed | RHSA-2026:60387 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:60390 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2026:60388 |
| Red Hat Advanced Cluster Management for Kubernetes 2.17 | Fixed | RHSA-2026:60386 |
| Red Hat Ansible Automation Platform 2.1 | Fixed | RHSA-2026:65118 |
| Red Hat Ansible Automation Platform 2.2 | Fixed | RHSA-2026:65155 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2026:71113 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:79088 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:69248 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:61783 |
| Red Hat Hardened Images | Fixed | RHSA-2026:48241, RHSA-2026:48320, RHSA-2026:59030 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat Openshift Data Foundation 4.19 | Fixed | RHSA-2026:92650 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:66084 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:66523 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:63307 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:69255 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:74511 |
| Red Hat Quay 3.18 | Fixed | RHSA-2026:81110 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:65514 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:83598 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:59593 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:59558 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:59559 |
Not affected: 43 products
- Gatekeeper 3
- Network Observability Operator
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.17
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.6 for RHEL 10
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat Openshift Data Foundation 4.19
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.18
- Red Hat Quay 3.9
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer 1.4
- Red Hat build of Apache Camel for Spring Boot 4
- multicluster engine for Kubernetes 2.17
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-67214
- 2026-10-03 Alias added: GHSA-28wg-ghj8-5hjv
- 2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
- 2026-10-09 Fix available: Red Hat Developer Hub 1.10 · Red Hat
- 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
- 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
- 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
- 2026-10-29 Affected versions changed · CNA
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
References
Patch 1
More nanoid_project Nanoid vulnerabilities
- TI-2026-47529 nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom CVSS 4.0HIGH 8.2
- TI-2021-06164 Information exposure in nanoid CVSS 3.1MEDIUM 5.5
Sources
- CVE-2026-67214 · CVE Program
- CVE-2026-67214 · NVD
- FIRST EPSS
- GHSA-28wg-ghj8-5hjv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-67214 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences